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This Briefing is Classified TOP SECRET//COMINT//ORCON//NOFORN 

DERIVED FROM: NSA/CSS Manual 1-52, Dated: 20070108, Declassify On: 20320108 
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• Sustain a deep, persistent, and pervasive presence on critical target networks 


• Rapidly penetrate and track the communications of high-value individuals 

• Continually execute ONE; support CNA and CND 

• CNE: Exploit networks for foreign intelligence 

• CNA: Provide access and capabilities to support authorized network attacks 

• CND: Hunt foreign cyber actors on foreign networks 

• Deconflict DoD CNO with IC/Foreign partners 

• Build the techniques, tools and infrastructure required 

• Subvert endpoint devices 

• Servers, workstations, firewalls, routers, handsets, phone switches, SCADA 
systems, etc. 

• Covertly communicate with implants in target networks 

• Automate CNE operations and maintenance of a large number of accesses 

Aggressively Scale CNO Capabilities and Operations 
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Field Operations 

(TS//SI//REL) The Field Operations Division is responsible 
for the developing and deploying customized SIGINT 
collection and data exfiltration solutions that enable 
remote network operations by gaining access to isolated 
target networks. The Division is also responsible for 
maintaining access to selected targets, exploring methods 
of enhancing the value from existing access, efficiently 
managing sustained operations, and working closely with 
the FBI and other HUMINT partners to plan and conduct 






(EAO) 

(TS//SI//REL TO USA FVEY) S3283 is the expeditionary arm 
of TAO which conducts worldwide Human-Enabled Close 
Access Cyber Operations to satisfy National and Tactical 
SIGINT access requirements. 


operations. 


Access and Target Development 

- (S//SI) Develop deep understanding of target communication 
techniques and practices of target entities with goal of 
identifying vulnerabilities that can be exploited via physical 
access. Define and develop physical access strategies, aligned 
to national requirements and TAO priorities, with emphasis on 
hard targets and isolated networks. Build and maintain 
significant relationships within the HUMINT community 
necessary for achieving access. Drive resulting operations to 
achieve end-to-end SIGINT successes. 


Persistence Divison 

(U//FOUO) The Persistence Division (S3285) conceives, develops, 
tests, and integrates sophisticated firmware and software-based 
capabilities and techniques to directly support three of Tailored 
Access Operations’ (TAO’s) mission technology focus areas: 
Persistence - IT/GEO - Computer Network Attack (TS//SI//REL 
FVEY) These firmware and software techniques are remotely 
deployable to target devices via a network connection or by 
physical interdiction. Regardless of the deployment methodology, 
these highly developed accesses operate covertly without any 
indication of their presence and provide TAO with unique and 
advanced capabilities that directly support NSA and its other 
Intelligence Community partners with some of their most significant 
successes. 
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(TS//SI) The Chief, Access Division is responsible to the Chief, Data Net-work 
Technologies Office to develop access to targets of interest to NSA. The 
Access Division focuses on developing remote access techniques and tools, 
ensuring continued remote access through the deployment of tools via remote 
or human assets, and assisting with remote access operations under the 
authority of the Remote Operations Center. The Access Division will act as the 
front door for DNT-wide efforts. The techniques developed should be scalable, 

automatable, and robust. 


Computer Technology 
Division, S3234 


(TS//SI) The Chief, Computer Technology Division is responsible to the Chief, 
Data Networks Technologies Office for collection against target networks. The 
Computer Technology Division focuses on the development of software 
implants, automation, and control tools to support endpoint operations. 


Network Technology 
Division, S3235 

(S//SI//REL) The Chief, Network Technology Division is responsible to the 
Chief, Data Network Technologies Office for the development of tools and 
techniques to exploit components on global and private networks supporting 

endpoint operations. 


Cyber Networks 
Technology Division, S3232 

(TS//SI) The Chief, Cyber Networks Technology Division (CNTD) is responsible 
to the Chief, Data Net-work Technologies Office to develop and deploy logically 
intrusive, software-based, end-point access techniques to enable Computer 
Network Operations (CNO) across multiple target operating systems and 
platforms. CNTD's purpose is to collect or enable collection of data for Foreign 
Intelligence and Operational Information and to include support to Information 

Operations. 
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